UK Enacts Data Security Compliance Program
Over the next several months, the University of Kentucky will roll out a Data Security Compliance Program (DSCP).
This new program will be the focus for UK’s compliance with federal requirements in the U.S. Department of Justice’s Data Security Program (DSP). UK’s DSCP will cover all UK employees and all others who interact with UK.
On Jan. 8, 2025, the Department of Justice (DOJ) issued the DSP regulations (28 CFR 202) to prohibit certain transactions involving protected U.S. data.
Under the DSP, foreign governments (Countries of Concern) currently include China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela, and Covered Persons include individuals or entities subject to jurisdiction, ownership, control or direction of Countries of Concern and other individuals or entities that the U.S. Attorney General may individually identify from or associated with any country.
The types of data covered by the DSP include:
The DSP prohibits knowingly engaging in data brokerage transactions with Covered Persons or Countries of Concern and transactions involving transfers of covered data to Covered Persons or Countries of Concern (e.g., human genomic data).
Other transactions, including investment, employment or vendor agreements with Covered Persons that provide access to sensitive data, are permitted only if specific Cybersecurity and Infrastructure Security Agency (CISA) requirements are met, along with DSP compliance program requirements, audits and recordkeeping.
Planning is underway to offer DSCP training to employees and others through the myUK Learning application, and details will be communicated when training becomes available.
Attention and adherence to these new rules and training will help UK:
https://www.research.uky.edu/news/uk-enacts-data-security-compliance-program